How to fix Permission denied (publickey). in SSH

SSHINTERMEDIATEHIGHUpdated Jan 4, 2026· 222 views

The "Permission denied (publickey)" error occurs when SSH cannot verify your identity using public key authentication. This typically results from missing SSH keys, incorrect file permissions, or the public key not being registered on the server.

Quick fix

Fixes Permission denied (publickey).

ls -la ~/.ssh/
  1. Verify your SSH key pair exists
  2. Fix file permissions on your local machine
  3. Add your public key to the remote server
  4. Verify the correct key is being used
ssh — error
ls -la ~/.ssh/
Permission denied (publickey).

What this error means

SSH uses public key cryptography for passwordless authentication. When you attempt to connect to a server, SSH tries to authenticate using your private key and verifies it against the public key stored in the server's ~/.ssh/authorized_keys file. The "Permission denied (publickey)" error means the server rejected your authentication attempt because: 1. Your private key doesn't exist or couldn't be read 2. Your public key isn't in the server's authorized_keys file 3. File permissions are incorrect (SSH is very strict about this) 4. You're connecting with the wrong username or to the wrong host 5. The SSH agent (if used) doesn't have your key loaded This is a security feature—SSH fails closed to prevent unauthorized access.

Typical symptoms

  • Unable to connect via SSH even though you have SSH keys
  • SSH connection hangs briefly, then displays the error
  • Works with password authentication (if enabled) but not with keys
  • Works on one machine but not another, for the same remote server
  • Works for one user account but not another

Common causes

  1. Your public key has not been added to the remote server's ~/.ssh/authorized_keys file
  2. File permissions on ~/.ssh directory or authorized_keys are too strict or too open (SSH requires exact permissions)
  3. Your private key is missing on the client machine or in an unexpected location
  4. SSH is trying the wrong key (multiple keys in ~/.ssh, wrong filename)
  5. The SSH agent is not running or doesn't have your key loaded (if using agent)
  6. Incorrect username in the SSH command (e.g., ssh root@host when you should use ssh ubuntu@host)
  7. Server SSH daemon (sshd) is configured to only allow specific authentication methods

How to fix "Permission denied (publickey)."

1Verify your SSH key pair exists

Check if you have SSH keys on your local machine:

bash
ls -la ~/.ssh/

Look for files like id_rsa (private key) and id_rsa.pub (public key). If they don't exist, generate a new key pair:

bash
ssh-keygen -t ed25519 -C "your-email@example.com"

Press Enter to accept the default location (~/.ssh/id_ed25519) and optionally set a passphrase.

2Fix file permissions on your local machine

SSH is very strict about file permissions. Incorrect permissions will cause this error:

bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
chmod 644 ~/.ssh/known_hosts  # if it exists
chmod 600 ~/.ssh/config        # if it exists

Verify the permissions are correct:

bash
ls -la ~/.ssh/

Expected output:
- drwx------ (700) for ~/.ssh
- -rw------- (600) for private keys
- -rw-r--r-- (644) for public keys

3Add your public key to the remote server

The easiest way is using ssh-copy-id:

bash
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@remote-host

Replace user with the correct username and remote-host with the server address.

If ssh-copy-id is not available, manually add it:

1. View your public key:

bash
cat ~/.ssh/id_rsa.pub

2. Copy the entire output (starts with ssh-rsa or ssh-ed25519)

3. Log into the server with password authentication (if available):

bash
ssh user@remote-host

4. On the server, ensure the ~/.ssh directory exists and has correct permissions:

bash
mkdir -p ~/.ssh
chmod 700 ~/.ssh

5. Append your public key:

bash
echo "your-public-key-here" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

6. Exit the server and try connecting again.

4Verify the correct key is being used

If you have multiple SSH keys, SSH might be trying the wrong one first. Use the -v flag to see which key is being used:

bash
ssh -v user@remote-host

Look for lines like:

bash
Trying private key: /home/user/.ssh/id_rsa

If it's trying the wrong key, explicitly specify the correct one:

bash
ssh -i ~/.ssh/id_ed25519 user@remote-host

To make this the default for a specific host, add it to your SSH config (~/.ssh/config):

bash
Host remote-host
  User user
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes
5Check the remote server's authorized_keys

Log into the remote server (using password auth if available) and verify your public key is there:

bash
cat ~/.ssh/authorized_keys

Your public key should appear as a single line starting with ssh-rsa or ssh-ed25519. If it's missing, add it using the steps above.

Also verify file permissions on the server:

bash
ls -la ~/.ssh/authorized_keys

Should be -rw------- (600) or -rw-r--r-- (644). If permissions are wrong:

bash
chmod 600 ~/.ssh/authorized_keys
6Enable verbose mode for detailed debugging

If none of the above worked, use maximum verbosity to see exactly where the authentication is failing:

bash
ssh -vvv user@remote-host

Common output patterns and what they mean:

"No more authentication methods to try"
- All authentication methods failed; the public key wasn't accepted

"Authentications that can continue: publickey"
- Server requires publickey auth, but your key was rejected

"No identity files matched"
- SSH couldn't find any keys in the expected locations

"Permission denied" after "Offering public key"
- Key was found but doesn't match what's in authorized_keys on the server

Check the server logs too (if you have access):

bash
sudo tail -f /var/log/auth.log | grep ssh

Look for messages like "Invalid user", "Authentication refused", or "key_type not in PubkeyAcceptedAlgorithms".

Advanced notes

SSH Agent and Key Loading: If you're using ssh-agent to manage multiple keys, ensure your key is loaded:

bash
# Start the agent if not running
eval "$(ssh-agent -s)"

# Add your key
ssh-add ~/.ssh/id_ed25519

# List loaded keys
ssh-add -l

Different Key Types: Modern SSH prefers Ed25519 keys over RSA. When generating new keys, use ssh-keygen -t ed25519. However, ensure the server supports your key type. For compatibility with older servers, RSA (4096-bit) is usually safe.

GitHub-Specific: If connecting to GitHub, ensure you're using the correct host:

bash
ssh -T git@github.com

Rootless/Unprivileged SSH: If running sshd as a non-root user, the standard ~/.ssh paths may not work. Check the server's sshd_config for AuthorizedKeysFile setting.

Frequently asked questions

What does "Permission denied (publickey)." mean?
SSH uses public key cryptography for passwordless authentication. ssh/authorized_keys file. The "Permission denied (publickey)" error means the server rejected your authentication attempt because: 1.
How do I fix "Permission denied (publickey)."?
The "Permission denied (publickey)" error occurs when SSH cannot verify your identity using public key authentication. This typically results from missing SSH keys, incorrect file permissions, or the public key not being registered on the server.
What causes "Permission denied (publickey)."?
Your public key has not been added to the remote server's ~/.ssh/authorized_keys file File permissions on ~/.ssh directory or authorized_keys are too strict or too open (SSH requires exact permissions) Your private key is missing on the client machine or in an unexpected location
Is the "Permission denied (publickey)." error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading